[Openswan Users] Should be a simple routing question

Paul Wouters paul at xelerance.com
Tue Aug 22 14:47:48 EDT 2006

On Tue, 22 Aug 2006, Andy Gay wrote:

> > Left <------> Right
> >      Site B                      Site A
> >
> > The tunnel works great - both sides see each ohter just fine, thanks to
> > lots of help from people in this list.
> >
> > Here's the issue.  When I traceroute from the siteB router at
> > to anything else in SiteB, it tries to route via SiteA!  Very strange
> > indeed!
> >
> > Well, it kind of makes sense because my tunnel definition evidently told
> > it to behave this way.  I was wondering if there is a way to make the
> > local route happen before the tunnel route?
> I don't think this is a routing issue, it's to do with IPsec policy.
> Your policy says anything with source address and
> destination should be sent through the tunnel.
> Try doing this on the siteB router:
> ip xfrm policy add dir in src dst
> ip xfrm policy add dir out src dst
> That will add some more specific policies for local traffic.
> I believe there's a way to do that using a passthrough conn as well, I'm
> not certain about the syntax for that.


conn pass-localstuff


More information about the Users mailing list